Many different ways of doing this - and it is good to be aware of them.
Some retailers (petrol stations, restaurants, shops and so on) or their employees have skimming devices. These are very small, hand held swipe machines - when the card is passed over for payment, the employee quickly swipes it which copies all the information. Then he watches the pin being keyed in, or uses a remote camera to record the transaction.
Thieves can put devices into cashpoint machines which work in the same way - copy the information and they get the pin by either looking over the shoulder or by small hidden camera.
Over the phone transactions give all the information necessary to make further transactions if the employee is dishonest.
This information could have been harvested months ago, making it very difficult for your father to pinpoint any possible transaction that could be responsible.